REVOLUT WAS NOT HACKED — IT ANSWERED A REQUEST FROM A REAL GOVERNMENT EMAIL DOMAIN — AND SENT OUT PASSPORTS, SELFIES AND FULL TRANSACTION HISTORIES

Revolut was not hacked. That is the part to sit with.

Requests for customer information arrived from a government agency’s real email domain, carrying valid authentication, over a period of months. Revolut answered them. The Financial Times reports the requests came through a compromised Italian government email system and that at least 680 accounts were affected. Revolut calls it “a sophisticated external impersonation scam.”

What went out the door: names, dates of birth, occupations, home addresses, passport and licence copies, the selfies people upload to prove they are themselves, account statements with IBANs and wallet references, withdrawal records, and full transaction histories.

A group calling itself iamnotavillain now wants 6,000 XMR, which it prices at $3,000,000, inside twenty-four hours, or it sells the files. Monero was $502.92 at the time of this writing, so six thousand of them is about $3.02 million.

Here is how they picked the people. They told the Financial Times they ran chain analysis first, found Revolut customers whose onchain activity suggested real holdings, and then went after those accounts.

The chain told them who was worth robbing. The file told them where he lives and what his face looks like.

The investigator ZachXBT, who first circulated the customer notice, said it looked targeted at high net worth users.

Revolut says it has had no direct contact, calls the number affected limited, and will not name the agency.

Nobody broke a lock. The front door worked exactly as designed.